﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="The number sign (#) command searches for the specified pattern in the disassembly code."/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title># (Search for Disassembly Pattern)</title>

<meta name="MS-HAID" content="r15_cmds_A_dc5ce1c6-3040-4d0a-82b7-fcfb9d62b486.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1957);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/___search_for_disassembly_pattern_.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="____evaluate_c___expression_.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="____system_status_.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugger_reference.htm">Debugger Reference</A> &gt; <A href="debugger_commands.htm">Debugger Commands</A> &gt; <A href="commands.htm">Commands</A> &gt; </div>
	<div id="winchm_template_title"># (Search for Disassembly Pattern)</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>The number sign (<b>#</b>) command searches for the specified pattern in the disassembly code.</p>
<pre class="syntax"><b># </b>[<i>Pattern</i>] [<i>Address</i> [ L <i>Size</i> ]]<b> </b></pre>
<h2><a id="ddk_cmd_search_for_disassembly_pattern_dbg"></a><a id="DDK_CMD_SEARCH_FOR_DISASSEMBLY_PATTERN_DBG"></a>Parameters</h2>
<p></p>
<dl>
<dt><a id="_______Pattern______"></a><a id="_______pattern______"></a><a id="_______PATTERN______"></a>       <i>Pattern</i>      </dt>
<dd>
<p>Specifies the pattern to search for in the disassembly code. <i>Pattern</i> can contain a variety of wildcard characters and specifiers. For more information about the syntax, see <a href="#Bookmark1923">String Wildcard Syntax</a>. If you want to include spaces in <i>Pattern</i>, you must enclose the pattern in quotation marks. The pattern is not case sensitive. If you have previously used the <b>#</b> command and you omit <i>Pattern</i>, the command reuses the most recently used pattern.</p>
</dd>
<dt><a id="_______Address______"></a><a id="_______address______"></a><a id="_______ADDRESS______"></a>       <i>Address</i>      </dt>
<dd>
<p>Specifies the address where the search begins. For more information about the syntax, see <a href="#Bookmark1927">Address and Address Range Syntax</a>.</p>
</dd>
<dt><a id="_______Size______"></a><a id="_______size______"></a><a id="_______SIZE______"></a>       <i>Size</i>      </dt>
<dd>
<p>Specifies the number of instructions to search. If you omit <i>Size</i>, the search continues until the first match occurs.  </p>
</dd>
</dl>
<h3><a id="Environment"></a><a id="environment"></a><a id="ENVIRONMENT"></a>Environment</h3>
<table>
<tr>
<td>
<p><b>Modes</b></p>
</td>
<td>
<p>User mode, kernel mode</p>
</td>
</tr>
<tr>
<td>
<p><b>Targets</b></p>
</td>
<td>
<p>Live, crash dump</p>
</td>
</tr>
<tr>
<td>
<p><b>Platforms</b></p>
</td>
<td>
<p>All </p>
</td>
</tr>
</table>
<p> </p>
<h3><a id="Additional_Information"></a><a id="additional_information"></a><a id="ADDITIONAL_INFORMATION"></a>Additional Information</h3>
<p>For more information about assembly debugging and related commands, see <a href="#Bookmark1370">Debugging in Assembly Mode</a>.</p>
<h2>Remarks</h2>
<p>If you previously used the <b>#</b> command and you omit <i>Address</i>, the search begins where the previous search ended.</p>
<p>This command works by searching the disassembled text for the specified pattern. You can use this command to find register names, constants, or any other string that appears in the disassembly output. You can repeat the command without the <i>Address</i> parameter to find successive occurrences of the pattern.</p>
<p>You can view disassembly instructions by using the <a href="#Bookmark2040"><b>u (Unassemble)</b></a> command or by using the <a href="#Bookmark1227">Disassembly window</a> in WinDbg. The disassembly display contains up to four parts: Address offset, Binary code, Assembly language mnemonic, and Assembly language details. The following example shows a possible display.</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>0040116b    45          inc         ebp            
0040116c    fc          cld                        
0040116d    8945b0      mov         eax,[ebp-0x1c] </pre>
</td>
</tr>
</table></span></div>
<p>The <b>#</b> command can search for text within any single part of the disassembly display. For example, you could use <b>#  eax  0040116b</b> to find the <b>mov eax,[ebp-0x1c]</b> instruction at address 0040116d. The following commands also find this instruction.</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>#  [ebp?0x  0040116b 
#  mov  0040116b 
#  8945*  0040116b 
#  116d  0040116b </pre>
</td>
</tr>
</table></span></div>
<p>However, you cannot search for <b>mov eax*</b> as a single unit, because <b>mov</b> and <b>eax</b> appear in different parts of the display. Instead, use <b>mov*eax</b>.</p>
<p>As an additional example, you could issue the following command to search for the first reference to the <b>strlen</b> function after the entry point <b>main</b>.</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre># strlen main</pre>
</td>
</tr>
</table></span></div>
<p>Similarly, you could issue the following two commands to find the first <b>jnz</b> instruction after address 0x779F9FBA and then find the next <b>jnz</b> instruction after that.</p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre># jnz 779f9fba# </pre>
</td>
</tr>
</table></span></div>
<p>When you omit <i>Pattern</i> or <i>Address</i>, their values are based on the previous use of the <b>#</b> command. If you omit either parameter the first time that you issue the <b>#</b> command, no search is performed. However, the values of <i>Pattern</i> and <i>Address</i> are initialized even in this situation. </p>
<p>If you include <i>Pattern</i> or <i>Address</i>, its value is set to the entered value. If you omit <i>Address</i>, it is initialized to the current value of the program counter. If you omit <i>Pattern</i>, it is initialized to an empty pattern.</p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
